All photos shared through Instagram are public by default. But users can go to a settings menu and enable a "Photos are private" option, meaning that future (but not existing) followers of that Instagram user will require approval. Few people appear to take that extra step.

"The larger issue to me is that Facebook is adding Instagram data to its own," says Ryan Calo, a privacy researcher at Stanford University's Center for Internet and Society. "Instagram users thought they were signing up for a simple service, of relatively little utility to advertisers or government. Now that data is likely to be combined with an entire social graph. I picture the consumer happily paddling down a data rivulet only to find themselves suddenly on the open waters of the social sea."

Instagram's current policies are privacy-protective: the company pledges not to "disclose personally-identifying information" except to employees, contractors, and so on. But in what one privacy lawyer told CNET was a glaring oversight, the privacy policy doesn't actually spell out what happens in an acquisition.

"To the extent that Instagram users signed up under certain, privacy-protective terms, those terms are still valid" even after the acquisition, says Justin Brookman, director of consumer privacy at the Center for Democracy and Technology. "Of course, for new data posted to Instagram, Facebook can set new terms."

Related stories

Concerns about privacy have cropped up before during corporate acquisitions. Advocacy groups raised concerns -- in retrospect, alarmist ones -- about the possibility of targeted advertising post-Time Warner-AOL. Google's purchase of DoubleClick was another.

In a 2007 decision that's binding in California, the U.S. Court of Appeals for the Ninth Circuit has ruled that users need to be notified before a terms of service modification applies to them (in other words, a silent change isn't good enough). And a California federal district court took the same approach in a 2010 decision involving an E-Trade account maintenance fee.

Says David Jacobs, a consumer protection fellow at the Electronic Privacy Information Center: "Neither case dealt explicitly with changes to privacy policies, but the principles might be applicable" to Facebook-Instagram.